Add a rolemap so plone specific roles have add permission, and move permission definition to zcml